Why am I unable to use the Splunk App and Add-on for Salesforce?

[euroa]

We are unable to capture any information on the Splunk App for Salesforce. We installed the Splunk Add-on for Salesforce to capture the data and I provided the Add-on with the required info (credentials, enabled inputs, etc). However no data is present in the App for Salesforce. When I went to go back to the Add-on, it will no longer load. I am seeing the following in errors in the internal logs:

-27-2017 15:48:41.686 +0000 ERROR AdminManagerExternal - Unexpected error "" from python handler: "REST Error [500]: Internal Server Error -- Traceback (most recent call last):\n  File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/handler.py", line 113, in wrapper\n    for name, data, acl in meth(self, *args, **kwargs):\n  File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/handler.py", line 348, in _format_all_response\n    self._encrypt_raw_credentials(cont['entry'])\n  File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/handler.py", line 382, in _encrypt_raw_credentials\n    change_list = rest_credentials.decrypt_all(data)\n  File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/credentials.py", line 289, in decrypt_all\n    return self._merge_passwords(data, realm_passwords)\n  File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/credentials.py", line 304, in _merge_passwords\n    password_dict = {pwd['username']: json.loads(pwd['clear_password']) for pwd in passwords}\n  File "/opt/splunk/etc/apps/Splunk_TA_salesforce/bin/splunk_ta_salesforce/splunktaucclib/rest_handler/credentials.py", line 304, in \n    password_dict = {pwd['username']: json.loads(pwd['clear_password']) for pwd in passwords}\n  File "/opt/splunk/lib/python2.7/json/__init__.py", line 339, in loads\n    return _default_decoder.decode(s)\n  File "/opt/splunk/lib/python2.7/json/decoder.py", line 364, in decode\n    obj, end = self.raw_decode(s, idx=_w(s, 0).end())\n  File "/opt/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode\n    raise ValueError("No JSON object could be decoded")\nValueError: No JSON object could be decoded\n".  See splunkd.log for more details.

While other errors that resemble:

ExecProcessor - message from "python /opt/splunk/etc/apps/Splunk_TA_salesforce/bin/sfdc_object.py"     raise HTTPError(response)

Any ideas what this could be?

[axavierequinix]

Hi Euroa,
We are using the Splunk Cloud and getting the following error - any idea?

The response status=500 for request which url=https://login.salesforce.com/services/Soap/u/39.0/ and method=POST.

Thanks,
-Francis

[euroa]

I am not sure, but what seemed to fix the issue for me (regarding the Addon for Salesforce) was first making sure that you are able to login to the Salesforce site with your provided credentials and having the Security token. Once you confirm that then fill out the configuration portion of the TA app and then go through each Input and adding the index name and the security token and saving and enabling each one. Ensure that the TA has global permissions as well so the App for Salesforce can read it. Also clear out the older settings on the Splunk App (if this was working before).

[axavierequinix]

Thank you Euroa! Are you using the Clound or the On-Prem version?
Could you please throw more light on TA?
I checked the credential from logging into the browser and salesforce dataloader - both works fine.

In Splunk input config, Is the Security token is simply the token or the concatenation of Password and the security token?

Also how can I test the salesforce credential in the Splunk add-on for salesforce? Don't seem to find that.

Appreciate all your help!
-Francis

[euroa]

Using Splunk Cloud. The security token gets placed under the section called "Inputs" on the TA itself. Ensure the TA is installed on the locations mentioned on the documentation. Login to your search head and go into the TA and click on Inputs > Action. There should be 6 inputs already there be default. The token goes there in the inputs. Theres a section that asks for security token. The password to the user credentials goes in a different part of the app under "configuration" on the top bar. I would suggestion enabling the loginhistory input first since it populates every minute by default.

[axavierequinix]

Thank you Euroa for your quick response. I have done everything that you had mentioned, but unfortunately the add-on for salesforce is not pulling any data from salesforce, but the input job runs successfully.
Upon searching the log, found 500 error on Salesforce call-
The response status=500 for request which url=https://login.salesforce.com/services/Soap/u/39.0/ and method=POST.

Checked with Salesforce support and found that Salesforce is not getting any hit/request from Splunk.

I followed the documentation and installed the TA as instructed.

If you have 5 mins, can we do a live meeting?

[jgedeon_splunk · Accepted solution]

Euroa,

The newer version of the app requires the TA. But it also requires older settings in the app to be removed.